You are almost there, but you need also to replace the IOSurface.kext patched from @ASentientBot , otherwise kernel panic when you attempt to load gpu framebuffer/acceleration.
About CoreDisplay and Skylight are constantly in use by the system they can only replaced in single user mode (or replaced by copy booting from another macOS HigherSierra Finder)
I do this way, using the CoreDisplay.framework and Skylight.framework (privateframework) both patched by @ASentientBot, I rename them in .framework2 and copy inside their respective Frameworks/Privateframeworks, then I reboot in single user mode (CMD+S) and type from Shell:
mount -uw /
cd /S*/L*/Frameworks/
mv CoreDisplay.framework CoreDisplay.backup
mv CoreDisplay.framework2 CoreDisplay.framework
cd /S*/L*/PrivateFrameworks/
mv SkyLight.framework SkyLight.backup
mv SkyLight.framework2 SkyLight.framework
exit
I have done IOSurface.kext one of the first. I was actually able to replace SkyLight.framework but the system caught me on CoreDisplay.framework.
I have a patched CoreDisplay sitting on my Desktop.
Which commands do I need from a single user to put it in a /S/L/F?
And the real question now: is it safe to do a hard power down as this seems the only option to get to the Single user mode?